diff --git a/bind.spec b/bind.spec
index 6f68447..f54a36f 100644
--- a/bind.spec
+++ b/bind.spec
@@ -25,7 +25,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.0
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -170,6 +170,7 @@ functionality.
 Summary: Development files for Bind libraries compiled with native PKCS#11
 Group:   System Environment/Daemons
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: bind-lite-devel%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description pkcs11-devel
 This a set of development files for BIND libraries (dns, isc) compiled
@@ -602,12 +603,6 @@ install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
 install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
 
-# Remove PKCS#11 related header files if disabled
-# TODO: this may not make sense - should be revisited in the future
-%if ! %{PKCS11}
-rm -rf ${RPM_BUILD_ROOT}%{_includedir}/bind9/{pkcs11,pk11}
-%endif
-
 %pre
 if [ "$1" -eq 1 ]; then
   /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
@@ -900,7 +895,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_includedir}/bind9/bind9
 %{_includedir}/bind9/isccc
 %{_includedir}/bind9/lwres
-%{_includedir}/bind9/pk11
 %{_mandir}/man1/isc-config.sh.1*
 %{_mandir}/man1/bind9-config.1*
 %{_mandir}/man3/lwres*
@@ -919,6 +913,8 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_includedir}/bind9/dst
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
+%dir %{_includedir}/bind9/pk11
+%{_includedir}/bind9/pk11/site.h
 %{_includedir}/bind9/isccfg
 
 %files chroot
@@ -1009,7 +1005,8 @@ rm -rf ${RPM_BUILD_ROOT}
 
 %files pkcs11-devel
 %defattr(-,root,root,-)
-%{_includedir}/bind9/pk11
+%{_includedir}/bind9/pk11/*.h
+%exclude %{_includedir}/bind9/pk11/site.h
 %{_includedir}/bind9/pkcs11
 %{_libdir}/libdns-pkcs11.so
 %{_libdir}/libisc-pkcs11.so
@@ -1022,6 +1019,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %{python3_sitelib}/isc/__pycache__/*py*
 
 %changelog
+* Tue Nov 22 2016 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-3.P1
+- Split pk11 includes, include real functions only in pkcs11 variant
+
 * Wed Nov 16 2016 Petr Menšík <pemensik@redhat.com> - 32:9.11.0-2.P1
 - Do not change lib permissions in chroot